Abstract

Differential cryptanalysis is a method of attacking iterated mappings which has been applied with varying success to a number of product ciphers and hash functions [1, 2]. Let ae : Z c 2 \Theta Z m 2 ! Z m 2 be a mapping that consists of c `control' bits and m `data' bits. The mapping ae mapping contains 2 c m-bit permutations ß i : Z m 2 ! Z m 2 ; 0 i 2 c \Gamma 1, one of which is selected (multiplexed) by the control bits, and a substitution is then performed on the data bits using the selected permutation. Such mappings will be called composite permutations . The S-boxes of DES are composite permutations of the form Si : Z 2 2 \Theta Z 4 2 ! Z 4 2 with 2 control bits and 4 data bits. In differential cryptanalysis the attacker is interested in the largest entry in a given XOR table, and the fraction of the XOR table that is zero. In this paper we determine the distribution of characteristics in the XOR tables of composite permutations, which leads to approximatio...

Citations